https://www.wordfence.com/blog/2018/07/baba-yaga-cyberwire-podcast/
In early June we published an article and accompanying white paper detailing an interesting malware infection which we’ve internally dubbed BabaYaga. The relatively sophisticated malware is unique because it contains a number of features intended to ensure the infected site remains in working order. It keeps WordPress core up to date, performs and stores backups and even scans for and
Source: Security Feed